[coneilen]

Summary

Bind action phases explicitly to their source-derived capture window identities so Wire completion cannot look up a nonexistent wire-completion capture key. Reject missing, foreign, stale or mismatched bindings before launch, without weakening process custody or action authority.

Changes

• Prepare hash-bound phase/capture-phase, scene/action and source identity bindings for Wire completion and terminal action groups; use the shared resolver for prelaunch, startup guards and geometry.
• Extend the unmodified production-entry dry run to prove every nonnull binding before its harmless launcher; retain explicit no-authority historical inspection separately from current-source product authority.
• Register 57 additional fail-closed binding contracts alongside the unchanged 18 import and 182/185 capture baselines. Preserve a zero-launch refusal as NO_PROCESS_LAUNCHES, not a held-exit claim.

Test plan

RED: pwsh -NoProfile -File Tools\windows\Tests\ActionWindowIdentity.Tests.ps1 -ScratchRoot C:\gcbi\red -> FAILED: The property 'wire-completion' cannot be found on this object. Actual production geometry lookup with only before/after keys; behavioral failure, not a compile failure.
GREEN: pwsh -NoProfile -File Tools\windows\Tests\ActionWindowIdentity.Tests.ps1 -ScratchRoot C:\gcbi\binding57 -> 57/57 passed, failed=0, skipped=0.
REGRESSION: pwsh -NoProfile -File Tools\windows\Tests\ValidationRunner.Tests.ps1 -> PASS, including UiCaptureDriver 182/182, ActionWorkerImport 18/18 and ActionWindowIdentity 57/57, zero skips.

• pwsh -NoProfile -File Tools\windows\Tests\ActionWorkerImport.Tests.ps1 -ScratchRoot C:\gcbi\entry18 -> 18/18 passed; actual accepted production entry and zero-launch setup refusal.
• pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -PrepareFixturesOnly -ScratchRoot C:\gcbi\prebuilt57 -> passed; final-source frozen fixture manifest SHA256 73432C3F1399B26EB1FABF76D6F6B18C0D87D1B434DF32601BB0B96B4C9D4AB3.
• pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -ScratchRoot C:\gcbi\baseline182 -PrebuiltFixtureManifest C:\gcbi\prebuilt57\fixtures.json -PrebuiltFixtureManifestSha256 (Get-FileHash C:\gcbi\prebuilt57\fixtures.json).Hash -> 182/182 passed, failed=0, skipped=0.
• pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -ScratchRoot C:\gcbi\real185 -PrebuiltFixtureManifest C:\gcbi\prebuilt57\fixtures.json -PrebuiltFixtureManifestSha256 (Get-FileHash C:\gcbi\prebuilt57\fixtures.json).Hash -RequireRealSeed -RealSeedZmxPath C:\gca-providers\zmx\zig-out\bin\zmx.exe -RealSeedZmxSha256 (Get-FileHash C:\gca-providers\zmx\zig-out\bin\zmx.exe).Hash -> 185/185 passed, failed=0, skipped=0; provider checkout verified at pinned 785b3fd15dcafd1882b495c831a10f98c201b908.
• pwsh -NoProfile -File Tools\windows\validate.ps1 -Task hardening -> deterministic repeated runs 3/3 passed; environment/product hardening not run.
• pwsh -NoProfile -File Tools\windows\validate.ps1 -Task privacy -> passed.
• & Tools\windows\Invoke-MatchedActionSupplement.ps1 -Repository (Get-Location).Path -OwnedRoot C:\gcbi\production-failed-job -ActionPlanPath C:\gcbi\production-failed-job\action-plan.json -ActionPlanSha256 8B6B0CCC27A077E817B52FE17BF366D1E6EB574BE080C9404D99253EAE1625A5 -DryRun -> unmodified production entry completed on clean committed source, using the unchanged failed-job bytes (SHA256 A70EAA7EE7E7BE805DB1C52B2A2ACA82860DE06F99C9D1FA32730409EDBD97CC). Six nonnull bound identities, including Wire completion, validated before the harmless launcher; restored same-process PMv2 DPI192, physical work area 3840x2064, adjusted outer 2906x1910, no resampling. Five numbered publications, held job empty and launcher stdout/stderr EOF; release RELEASED_ZERO_SURVIVORS. No target-private-EOF claim.
• Production proof: C:\gcbi\production-failed-job\production-entry-evidence.json, SHA256 60288A090BC5578158FCFE122A20C1B2100E4218571015370D92FB0A2D1424E8. Independently verified all 20 inventory artifacts and the five-publication predecessor/hash/authority chain.
• PowerShell parser -> all 8 changed script/module files passed. git diff origin/main...HEAD --check -> passed. git ls-files --eol -> all 9 touched committed blobs and working files LF.

Evidence limits: the RED reproduces the proven namespace mismatch, not the unavailable original throwing stack. Early source-changing/stale-fixture refusals and a real 180/182 scene-routing regression were retained; that regression was fixed and fresh complete suites passed. Superseded interrupted runs are not counted as passes. One early log filename was accidentally reused; its complete original tool output was recovered byte-for-byte into a separate retained artifact. Both historical failure bundles and raw roots remain unchanged.

No W1-W6 product actions, product/provider action-campaign launches, PNGs, C8R campaign, product source changes or parity promotions. Real-zmx launches above are isolated qualification fixtures only. The dry run is DRY_RUN_NO_AUTHORITY, not current action authorization, runtime product-window proof, native interaction proof or parity evidence. macOS make test/make check were not run on this Windows host; path-gated CI cannot establish cross-platform runtime parity.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure